diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 0000000..fa5e8f3
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,21 @@
+name: CI
+
+on:
+  push:
+    branches: [master, main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - run: npm ci
+      - run: npm run lint
+      - run: npm run build
diff --git a/.gitea/workflows/deploy-ift.yml b/.gitea/workflows/deploy-ift.yml
new file mode 100644
index 0000000..d35cccd
--- /dev/null
+++ b/.gitea/workflows/deploy-ift.yml
@@ -0,0 +1,48 @@
+name: Deploy IFT (admin)
+
+on:
+  push:
+    branches: [master, main]
+  workflow_dispatch:
+
+jobs:
+  deploy-ift-admin:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - run: npm ci
+      - run: npm run build
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Login to registry
+        uses: docker/login-action@v2
+        with:
+          registry: git.sabilin.com
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Build and push admin-ui
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          push: true
+          tags: git.sabilin.com/eventhub/eventhub-admin-ui:ift
+
+      - name: Deploy admin on IFT via SSH
+        uses: appleboy/ssh-action@v0.1.5
+        with:
+          host: ${{ secrets.IFT_SSH_HOST }}
+          username: ${{ secrets.IFT_SSH_USER }}
+          key: ${{ secrets.IFT_SSH_PRIVATE_KEY }}
+          script: |
+            export REGISTRY_USER='${{ secrets.REGISTRY_USER }}'
+            export REGISTRY_PASSWORD='${{ secrets.REGISTRY_PASSWORD }}'
+            /opt/eventhub-ift/devops/scripts/deploy-service.sh ift admin
diff --git a/.gitea/workflows/deploy-stage.yml b/.gitea/workflows/deploy-stage.yml
new file mode 100644
index 0000000..16de4ef
--- /dev/null
+++ b/.gitea/workflows/deploy-stage.yml
@@ -0,0 +1,42 @@
+name: Deploy stage (admin)
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+jobs:
+  deploy-stage-admin:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - run: npm ci
+      - run: npm run build
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Login to registry
+        uses: docker/login-action@v2
+        with:
+          registry: git.sabilin.com
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Build and push admin-ui
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          push: true
+          tags: git.sabilin.com/eventhub/eventhub-admin-ui:stage
+
+      # Stage admin stack — когда появится stage/docker-compose.admin.yml
+      - name: Note
+        run: echo "Образ :stage опубликован. Admin stack на stage — отдельный шаг."
diff --git a/nginx.conf b/nginx.conf
index 32afb87..15653d2 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -3,12 +3,16 @@ server {
     root /usr/share/nginx/html;
     index index.html;
 
+    # Docker embedded DNS — не кэшировать IP upstream при redeploy eventhub
+    resolver 127.0.0.11 valid=10s ipv6=off;
+
     location / {
         try_files $uri $uri/ /index.html;
     }
 
     location /v1/ {
-        proxy_pass http://eventhub:8445;   # admin-api слушает HTTP на порту 8445
+        set $eventhub_api eventhub;
+        proxy_pass http://$eventhub_api:8445;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
@@ -17,7 +21,8 @@ server {
     }
 
     location /admin/ws {
-        proxy_pass http://eventhub:8446;   # admin-ws слушает HTTP на порту 8446
+        set $eventhub_ws eventhub;
+        proxy_pass http://$eventhub_ws:8446;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "upgrade";